ETSI EN 319 411-2 How should qualified trust service providers handle revocation under ETSI EN 319 411-2

ETSI EN 319 411-2 makes the EN 319 411-1 revocation request controls applicable to qualified certificate services. In practice, the QTSP's CPS should define who can submit revocation requests or event reports, how they are submitted, when confirmation is required, what reasons can lead to suspension or revocation, and which mechanism distributes revocation status information. The procedure should separate a request from an event report: both need intake and authorization controls, but the party reporting a key compromise or policy breach may not be the subscriber asking for revocation.

The timing control is concrete: EN 319 411-1 requires the actual certificate status change to be available to relying parties no later than 24 hours after receipt of the revocation or suspension request. If confirmation cannot be completed within that window, the CPS needs an exception procedure and the QTSP must record the actions taken and justification. Under eIDAS Article 24(3), revocation takes effect immediately when the published status changes.

Evidence should show that the QTSP can receive, authenticate, decide, publish, and preserve revocation status consistently for the qualified certificate profiles it issues. Follow the sequence from the request or event report through the certificate database update and CRL or OCSP publication.

For revoked or suspended certificates, keep enough records to prove the received request time, authorization check, confirmation or exception path, decision time, certificate-database update, status publication time, and notification to the subject or subscriber where possible. Article 24(4) requires per-certificate information to be automated, reliable, free of charge, efficient, available at any time, and available beyond validity. Reconcile the source ticket, database, CRL, OCSP response, and subscriber notice so their certificate identifier, reason, and timestamps agree.

Use a checklist that follows the certificate lifecycle clauses. The review should prove that requests and event reports are controlled, suspension is separated from permanent revocation, revoked certificates are not reinstated, and relying parties can obtain status information through the published mechanisms. Repeat the review after a policy or status-service change, key compromise, QSCD status change, CA termination, failed publication, or missed 24-hour deadline.